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ATTACHMENT TO THE PRE-APPEAL BRIEF REQUEST FOR REVIEW 

Pre-appeal review is requested because the rejections of record are improper for at least 
the reasons set forth below. 
Status Of The Claim s 

Claims 1-17, 20, and 22-34 are pending and stand rejected. Claims 1-10, 12-17, 20, and 
22-34 stand rejected under 35 U.S.C. § 103(a) as being unpatentable over Bates et al., U.S. Patent 
6,721,721, in view of Hericourt et al., U.S. Patent 7,099,916. Claim 11 stands rejected as being 
unpatentable over the combination of Bates and Hericourt in view of Symantec, "Norton 
Antivirus Corporate Edition." The Panel is requested to withdraw the § 103(a) rejections in 
view of the remarks below. 

The Rejection Of The Claims Is Predicated On An Unreasonable Interpretation 

The claimed invention uses a virus outbreak report indicating a virus attack to compute a 
computer virus alert time. The computer virus alert time is compared with a time stamp 
corresponding to an earliest moment or first time computer code was allowed to execute on a 
computer coupled to a computer network, and the executability of the computer code is 
determined in response to the comparison. Specifically, most of the independent claims recite 
limitations corresponding to: 

entering a first computer virus status mode in response to a first computer virus 
outbreak report indicating a virus attack threat to a computer network; 

computing a first computer virus alert time corresponding to entry into the first 
computer virus status mode; 

comparing a time stamp of executable computer code corresponding to an earliest 
moment the computer code was allowed to execute on a computer coupled to 
the computer network with the first computer virus alert time; and 

determining the executability of the computer code in response to the result of the 
comparing step. 
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(quoting from claim 1). Dependent claim 8 further recites that the "computer code is determined 
to be executable only when the computer code is time stamped prior to the first computer virus 
alert time." In other words, the computer code is executable because it executed before the virus 
alert and, therefore, is unlikely to be infected by the virus implicated in the alert. Independent 
claim 34 resembles claim 1, except that the time stamp of the executable computer code 
corresponds "to a first time the computer code was allowed to execute on a computer coupled to 
the computer network." 

The cited references, at the least, fail to disclose a time stamp "corresponding to an 
earliest moment the computer code was allowed to execute on a computer..." or "corresponding 
to a first time the computer code was allowed to execute on a computer. . ." Bates discloses a 
system that integrates virus checking functionality into a computer database search environment, 
thereby allegedly decreasing the risks of viruses associated with accessing search results from 
computer database searches. See Bates, Abstract; column 3, lines 1-3. At col. 9, line 56 - col. 
10, line 8, Bates describes how the user can assess the "trustworthiness" of a search result file by 
setting a virus criterion as to (i) whether the file has been virus checked within a predetermined 
period of time; (ii) whether the file has been changed since the last time a virus check was 
performed; or (iii) whether a particular period of time has elapsed in which the file has been 
found to be free of viral infection. Thus Bates at most discloses use of a single time stamp 
indicating the time the file was last checked for a virus. There is no teaching or suggestion in 
Bates of a time stamp that indicates the earliest moment or first time computer code was allowed 
to execute. 

In fact, Bates does not even teach or suggest recording computer code execution times. 
The Examiner acknowledges this deficiency of Bates, and seeks to cure it by citing to Hericourt. 
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This latter reference provides an overview of antivirus software, and describes how a suspect file 
can be executed in a protected location to see if it exhibits any virus-like behavior. Hericourt, 
col. 3, lines 52-54. Hericourt does not teach or suggest using time stamps for any purpose. 
However, the Examiner alleges that Hericourt teaches that scanning a file can comprise an 
execution of the file. Therefore, according to the Examiner, when Bates and Hericourt are 
combined Bates' time stamp indicating when a file was found free of a viral infection becomes a 
time stamp indicating when the file was executed. 

The combination of Bates and Hericourt does not render the claimed invention obvious 
because neither reference discloses or suggests using a time stamp that corresponds to an earliest 
moment, or first time, the computer code was allowed to execute on a computer coupled to a 
computer network. If the references are combined in the manner suggested by the Examiner, the 
time stamp at most represents a code execution occurring at an arbitrary time. The combination 
does not teach or suggest time stamping the earliest or first time code was executed; there might 
have been prior executions occurring before the time-stamped execution. Moreover, even if a 
particular time stamp in Bates did represent the earliest code execution, this happenstance event 
would not support the rejection. See In re Robertson, 169 F.3d 743, 745 (Fed. Cir. 1999) (stating 
that the mere fact that a certain thing may result from a given set of circumstances is not 
sufficient to support a rejection based on inherency); MPEP 2112 IV. Thus, a person of ordinary 
skill in the art at the time the invention was made, considering the teachings of the references 
either alone or in combination, would not find the claimed invention obvious. 

The Examiner's defense of this rejection is essentially predicated on an unreasonable 
interpretation of the claims. Claims must be given their broadest reasonable interpretation 
consistent with the specification. Phillips v. AWH Corp., 415 F.3d 1303 (Fed. Cir. 2005); MPEP 
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§ 21 1 1. Here, the Examiner's interpretation is unreasonable because it calls code executions 
"earliest" or "first" even if prior code executions have occurred. 

The unreasonableness of the Examiner's interpretation is demonstrated through 
Applicants' and the Examiner's exchanges concerning this rejection. In a previous Office 
Action, the Examiner supported the rejection by stating that code can be executed multiple times, 
and that: 

. . .out of the multitude of instances a particular piece of computer code is 
executed, either via scanning or via end-user execution, the timestamp associated 
with the virus check for that computer code represents "an earliest execution 
time" in comparison to subsequent instances of execution for that piece of 
computer code. 

(Office Action of January 1 1, 2008, page 18 lines 2-6). In response, Applicants argued that: 

a particular timestamp in Bates cannot be said to represent the "earliest" execution 
because there are an arbitrary number of executions that occur before and after the 
execution represented by the timestamp. 

(Amendment of April 10, 2008, page 14 lines 18-21). Thus, Applicants argued that there can be 

any number of executions before and after a given execution, and no time stamp in Bates 

necessarily represents the earliest or first execution. 

The Examiner now asserts that Applicants have "admitted" that the time stamped 

'"execution time' is subsequently followed by a plurality of executions of the software." (Office 

Action of July 10, 2008, page 4 lines 12-14). And, therefore, Applicants: 

reasonably must also acknowledge that within such a sequence the time-stamped 
execution represents "an earliest" time of execution in comparison to the 
subsequent executions within that sequence 

(Office Action of July 10, 2008, page 17, lines 10-13, emphasis in original). 

In other words, the Examiner calls any given time-stamped execution the "earliest" or 

"first" one by arbitrarily excluding from consideration any executions that came before it. For 
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example, if there were three sequential executions, the Examiner would call execution two "an 
earliest" execution because it occurred before execution three, even though execution one 
occurred earlier. Moreover, if there were a sequence of 10 time stamps, the Examiner would call 
nine of the time stamps "first." This interpretation is improper because it is clearly unreasonable. 

The Symantec reference fails to remedy the deficiencies of Bates and Hericourt described 
above. Therefore, a person of ordinary skill in the art, considering the teachings of the references 
either alone or in combination would not find the claimed invention obvious. 

Based on the foregoing, Applicants respectfully submit that the § 103 rejections suffer 
from clear deficiencies. Accordingly, Applicants requests that the rejections be withdrawn. 

Respectfully submitted 
Carey S. Nachenberg et al. 



Date: October 10, 2008 B y /Brian Hoffman/ 

Brian M. Hoffman, Reg. No. 39,713 
FENWICK & WEST LLP 
Silicon Valley Center 
801 California Street 
Mountain View, C A 94041 
Tel.: (415) 875-2484 
Fax: (650)938-5200 
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